Add generic microphone backends with D-Cerno runtime support

Integrate the tested Televic D-Cerno client as a local-streamer microphone backend alongside Bosch. User explicitly requires vendor-specific shared systems, commands and names to become generic; retain vendor names only for concrete adapters/backend selection. Reuse current speaker/PTZ/queue transitions instead of duplicating command logic. Scope and decisions: - Generic microphone configuration, handles, seat mappings, status, queue source and physical-chair trigger across streamer, protocol, router, provisioning and dashboard/panel consumers. Preserve existing saved Bosch configuration through explicit legacy read aliases/migration where practical; document rolling-version boundaries. - Select a single configured backend, validate configuration and mapping IDs, redact/preserve credentials in provisioning APIs, and avoid storing the supplied test credentials in repository content. - Bosch keeps existing speaker, waiting-list and priority-interjection behavior. D-Cerno uses explicit full-flag updates for command writes, cursor-based event polling, state reconciliation after startup/reconnect/discontinuity and periodic snapshots; no blind event replay or stale disconnected status. - Operator queue remains authoritative. Bosch may mirror order as before; D-Cerno mirrors request membership without clearing/rebuilding to simulate an unsupported reorder operation. - Generic watcher bridge owns queue/status publishing and existing chair/self-stop transitions. Preserve seatless overlay and meeting teardown behavior. Acceptance criteria: - Start/stop speaker, queue edits/dequeue/requeue, meeting stop/reset and mapped physical chair/self-stop operate through the selected backend with errors surfaced. - D-Cerno watcher maintains valid snapshot/cursor state, reconciles gaps/reconnects, and clears disconnected handles/status without false speaker transitions. - Public APIs, provisioning controls and dashboard/local-panel displays use generic names and support selecting/configuring D-Cerno; legacy Bosch configurations remain loadable and secrets stay write-only/redacted. - Regression tests cover both adapters, shared flows, protocol/config compatibility, unsupported queue reordering behavior, watcher lifecycle and failure recovery. - Relevant Rust formatting/check/tests/Clippy and dashboard checks/build pass; browser validation for changed UI and physical-controller validation are performed where available, preserving limitations. No commits without further authorization. Authorized hardware integration scope: - User supplied the test box SSH destination streamer@192.168.50.175 and explicitly authorized changing it without preserving its current state. - The box is currently bound to the production router. Isolate production-bound streamer/provisioner connections before sending test controls, then point the box at a disposable local NATS/router setup and deploy/test the current implementation against the local D-Cerno controller. - Limit changes to this test box and the isolated local stack. Do not change production router state or send test commands through production. Verified outcome: - Added the standalone D-Cerno API client and integrated Bosch/D-Cerno behind generic microphone configuration, mappings, status, queue sources, commands, provisioning and UI. Room protocol is v5 and provisioning protocol is v2; existing Bosch JSON/environment aliases remain readable while new writes are generic. - D-Cerno uses full seat-state writes, cursor event polling, authoritative and periodic reconciliation, reconnect state cleanup and request-membership synchronization without pretending to reorder the device. Shared transition serialization prevents stale physical work from clearing a replacement speaker or crossing sessions/meetings. - Full workspace check and tests passed: 448 tests passed, 0 failed, with 5 existing/opt-in ignored tests. Workspace Clippy completed with existing warnings only. Dashboard 28 tests/build, formatting, diff whitespace and Cascade Dockerfile build-check passed. - Browser fixtures verified generic mapping/editor fields, multiple active microphones, Bosch/Televic selection, token masking/retention, MIC queue entries, disconnected/restricted states and mobile layout. Quick-bind completion/rebind was not independently completed in Chrome because the follow-up run was cancelled for hardware testing. - Physical validation on the isolated test box passed with the real D-Cerno controller, Kiloview NDI source and Televic PipeWire audio: generic seat mappings, operator and physical speaker transitions, chair takeover, queue operations, H.264/AAC SRT output and teardown. The user also exercised the dashboard and reported expected behavior. HTTPS, forced event-store discontinuity and physical-button race stress remain unverified. - Pull request #145: https://git.kaukus.no/Kaukus/streaming-engines/pulls/145 Rebase follow-up completed: PR #145 is rebased onto main 812cf85 and published as 9800cb3 / 27a9806 using an explicit force-with-lease against the prior head 4fd149a. Seven conflicted files reconciled OS-update controls/tests and generic microphone configuration; fixture provisioning now preserves both flows. Newly merged development scripts contain no Bosch references. All-target check caught and corrected a missing os_updates test field and stale config.bosch assertion. Found a semantic wire collision: main already uses assignment v2 for OS updates, so generic provisioning is now v3; router publishes v3 with or without OS policy and agent accepts only v3. Protocol/isolated provisioning assertions and rollout documentation updated; PR description corrected accordingly. Verified after rebase: workspace all-target check; workspace tests (554 passed, 0 failed, 8 ignored); both normally ignored provisioning/NATS tests passed against a disposable local NATS container; Clippy completed with existing warnings; formatting and branch whitespace checks passed; all 31 dashboard tests and production build passed; all 6 development CLI tests passed. Focused Chrome smoke on isolated synthetic fixtures verified combined OS/microphone edits and review, reload persistence, blank retained token, URL-only patch exclusion of credentials/OS settings, and partial OS-apply mismatch/retry preserving microphone configuration. No dashboard exceptions; incidental 401 resource errors on direct fixture pages did not block checks. No hardware/deployment rerun or remote CI success claimed. Temporary servers/container stopped, existing development services untouched. PR reports No Conflicts; clean synchronized feature/microphone-backends worktree. Logs/range comparison: /tmp/pr145-rebase-validation/.